Barsec Cyber Intel
Hackers Are Using WordPress Plugins to Hide Administrator Accounts.
Security researchers at Patchstack have seen attackers use flaws in Ninja Forms and WPC Product Bundles to create admin accounts that do not show up in the WordPress dashboard. Updates are available.
What happened
Patchstack reports a campaign that plants harmful code in a contact form submission (Ninja Forms) or a store order (WPC Product Bundles for WooCommerce). When a site administrator opens that submission or order, the code quietly runs using the administrator's login. From there it installs a malicious plugin, creates a new administrator account hidden from the Users screen, and sets up a secret login link. Patchstack observed these attempts starting in early October 2026.
Why this matters
A hidden administrator means someone else can control your website while everything looks normal on your end. Because the account does not appear in the dashboard, you cannot spot it just by looking at your user list. Ninja Forms alone runs on more than 500,000 sites, so this is worth checking even if nothing seems wrong.
What you should do
- Update Ninja Forms to version 3.15.4 or later, and WPC Product Bundles for WooCommerce to 8.6.7 or later. Using the latest version of each is best.
- Ask your web developer or host to check for administrator accounts directly in the database, since a hidden one will not show in the dashboard. Names like "support", "updater" or "maintenance" with an @wordpress.org email are a warning sign.
- Ask them to look for unfamiliar plugins, including "must-use" plugins, which do not appear in the normal plugin list.
- If anything suspicious turns up, change all admin passwords, especially the oldest admin account, and have the site fully cleaned.
- If you are not sure whether your site uses these plugins or how to check, send Barsec a message and we can help.